NPM? Not my problem.

New Shai-Hulud campaign compromises popular npm packages. Easterly says small municipalities shouldn’t have to fend for themselves. Chinese threat groups accelerate exploits. Samsung bans smart TV apps with residential proxies. Hackers breach a Liechtenstein banking database. Swiss government IT agency hit in suspected SharePoint Attack. Microsoft’s bug bounty program awards record payouts. Researchers expose privilege boundary flaw in AI-driven CI/CD workflows. Roberta Anderson, Air Force veteran and CISO at Onterris is sharing her "Breaking the Firewall" book. And, bug hunting turns into bug sorting.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Roberta Anderson, Air Force veteran and CISO at Onterris, sharing her "Breaking the Firewall" book.

Selected Reading

Keyv and friends compromised in npm supply chain attack (Aikido)

Small Towns Shouldn’t Have to Defend America’s Water Supply From Iran (The New York Times)

China-Linked Threat Actors Weaponize New Vulnerabilities in Under a Day (Infosecurity Magazine)

Samsung bans smart TV apps that share users' internet connections with strangers (TechCrunch)

Liechtenstein says hackers access information on 31,000 legal entities (Reuters)

Swiss IT agency hacked, 200 accounts compromised, SharePoint vulns suspected (The Record)

Microsoft Bounty Program year in review More than $20 million awarded in our biggest year yet (Microsoft Security Response Center)